--- analysis: This hunt pivots from anomalous registry volumes to script-level encryption calls and correlates them within a narrow time window, providing context that a single detection rule lacks. blind_spots: - id: no-script-block-logging question: What specific logic was executed to decrypt the staged registry payloads? requires: hb_script_activity with full auditing (Event ID 4104) risk: We might see the registry artifacts but fail to confirm the malicious script logic without full block logging. stage: registry-payload-staging - id: registry-retention question: Which process performed the registry writes? requires: hb_registry_activity (Sysmon event stream / log rows) risk: If only snapshots are available, we identify the staged payloads but not the historical actor process that wrote them. stage: registry-payload-staging coverage: - stage: execution-powershell-dropper status: covered steps: - hidden-powershell-lead - stage: registry-payload-staging status: covered steps: - registry-staging-scoping - dpapi-script-activity - reason: "Belongs to another part of the \"FSB\u2019s matryoshka #3/3: Gamaredon's\ \ Gammasteel Infostealer\" series." stage: persistence-run-key-pointer status: out_of_scope - reason: "Belongs to another part of the \"FSB\u2019s matryoshka #3/3: Gamaredon's\ \ Gammasteel Infostealer\" series." stage: drive-and-profile-discovery status: out_of_scope - reason: "Belongs to another part of the \"FSB\u2019s matryoshka #3/3: Gamaredon's\ \ Gammasteel Infostealer\" series." stage: s3-exfiltration status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: GammaSteel's DPAPI-bound registry staging bypasses traditional file-system monitoring; verifying the integrity of these registry hives is essential for detecting persistent, fileless espionage. methodology: model-assisted trigger: intel-report hypothesis: An intruder has staged encrypted PowerShell payloads in the user Printers registry hive and is executing them via hidden processes that avoid file-based detection. labels: - hunt - attack.t1059.001 - attack.t1547.001 name: Gammasteel Fileless PowerShell Registry Staging parameters: lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-06-11' ref: standard-lookback type: number scope_hosts: default: [] description: Specific hosts to narrow the hunt; leave empty to scan the full estate. from: kind: manual observed: '2026-06-11' ref: analyst-defined type: list[host] staging_registry_path: default: '%\printers\%' description: Registry path pattern where Gammasteel functions are staged, accounting for provider variations in hive naming. from: kind: article observed: '2026-06-11' ref: sekoia-gammasteel type: string provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.sekoia.com/blog/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on user workstations where sensitive documentation is handled; Gamaredon targets HKCU, so the staging is user-specific. references: - name: "FSB\u2019s matryoshka #3/3: Gamaredon's Gammasteel Infostealer" url: https://www.sekoia.com/blog/fsbs-matryoshka-3-3-gamaredons-gifts-that-keeps-unpacking-gammasteel related: - hunt: gamaredon-run-key-persistence reason: The Run key persistence pointer is handled in a separate hunt in this series. relation: out-of-scope-alternative scenario: stages: - name: PowerShell Dropper Execution observables: - powershell.exe -nol -nop -enc - Start-Process -FilePath "powershell" -ArgumentList "-noexit" - -WindowStyle Hidden - Global\assembly307 slug: execution-powershell-dropper tactic: execution techniques: - T1059.001 - name: Fileless Registry Staging via DPAPI observables: - HKCU\Printers - KeZdDboas5kpxbkgxxvBx - ConvertTo-SecureString - ConvertFrom-SecureString - 71 PowerShell functions slug: registry-payload-staging tactic: defense-evasion techniques: - T1059.001 - name: Persistence via Run Key Pointer observables: - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - 'Value name: $env:os' - YxwHku2chu0bznt3kkyAB - powershell.exe -w hidden -command "$a='HKCU:\Printers'; $b=Get-ItemProperty ..." slug: persistence-run-key-pointer tactic: persistence techniques: - T1547.001 - name: WMI Drive and Profile Discovery observables: - gwmi win32_userprofile - S-1-5-21 - Get-PSDrive -PSProvider FileSystem - Get-CimInstance Win32_LogicalDisk - System.Timers.Timer - 'Interval: 3600000' slug: drive-and-profile-discovery tactic: discovery techniques: - T1047 - T1555 - name: Data Exfiltration to S3 Storage observables: - tebi.io - MD5 hash deduplication log - plLmfuh4uctxjtrQSXC slug: s3-exfiltration tactic: exfiltration techniques: - T1041 summary: Gamaredon's GammaSteel infostealer utilizes an advanced fileless mechanism, staging 71 encrypted PowerShell functions directly in the Windows registry using DPAPI. The malware achieves persistence through Run key pointers and employs recurring WMI-based scans and hardware listeners to identify and exfiltrate user documents to S3-compatible cloud storage. series: index: 1 slug: fsb-s-matryoshka-3-3-gamaredon-s-gammasteel-infostealer title: "FSB\u2019s matryoshka #3/3: Gamaredon's Gammasteel Infostealer" total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Gammasteel Fileless PowerShell Registry Staging This hunt identifies the initial staging and orchestrator execution of the GammaSteel infostealer. The malware uses DPAPI to encrypt over 70 functions directly into the HKCU\Printers registry key, achieving fileless persistence. The orchestrator then runs from a hidden PowerShell process, reading and executing these functions directly in memory. We correlate unusual registry write volume in the Printers hive with script execution patterns involving DPAPI and hidden process command lines. ## registry-staging-scoping Identify hosts where an anomalous number of registry values are written to the Printers key, indicating payload staging. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days, staging_registry_path=staging_registry_path) ~~~yaml expected: Hosts with multiple registry values written to the Printers hive. GammaSteel typically writes 71 unique keys. reads: - device_hostname - reg_target - activity_id - time silence: not_evidence_of_absence source: hb_registry_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, COUNT(DISTINCT reg_target) AS unique_keys, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '{{staging_registry_path}}' AND activity_id = 2 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname HAVING unique_keys > 5 ORDER BY unique_keys DESC ``` ## corroborate-staging parallel: - → dpapi-script-activity - → hidden-powershell-lead join: → triage-staging ## dpapi-script-activity Detect the script content that uses DPAPI or native cryptography calls to protect payloads before writing them to the Printers key. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Script blocks calling DPAPI encryption cmdlets or the ProtectedData class alongside references to the Printers hive. reads: - device_hostname - script_content - time silence: not_evidence_of_absence source: hb_script_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%convert%securestring%' OR LOWER(script_content) LIKE '%protecteddata%' OR LOWER(script_content) LIKE '%cryptprotectdata%' OR LOWER(script_content) LIKE '%cryptunprotectdata%') AND LOWER(script_content) LIKE '%printers%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## hidden-powershell-lead Find hidden PowerShell processes that execute around the same time as the registry activity to identify the orchestrator. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: PowerShell processes launched with hidden windows or suppressed profiles, especially when matching the timing of registry writes. reads: - device_hostname - process_cmd_line - parent_process_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%powershell.exe' AND (LOWER(process_cmd_line) LIKE '%-w hidden%' OR LOWER(process_cmd_line) LIKE '%-windowstyle hidden%' OR LOWER(process_cmd_line) LIKE '%-nol %' OR LOWER(process_cmd_line) LIKE '%-nop %') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-staging ```agent target=hunter cite: required context: - registry-staging-scoping - dpapi-script-activity - hidden-powershell-lead max_iterations: 6 objective: Determine if a host shows the GammaSteel staging pattern. Specifically, correlate the hidden PowerShell process execution with registry writes in the Printers hive within a 10-minute window, and identify DPAPI-related script blocks. success_criteria: A per-host verdict citing the registry keys, script blocks, and temporal correlation with hidden processes. tools: - endpoint ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-endpoint indeterminate: → remediate-registry unavailable: → remediate-registry (blind_spot: no-script-block-logging) else: → remediate-registry ## isolate-endpoint ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host and collect the HKCU registry hive for forensic analysis. ``` → remediate-registry ## remediate-registry ```manual target=analyst Review the cited script content. Check for the Global\assembly307 mutex. Purge any confirmed malicious values under HKCU\Printers and the corresponding Run key pointer. ``` → close-out ## close-out ```manual target=analyst Record the findings and ensure the hidden PowerShell detection is tuned to monitor for high-volume registry activity in the Printers hive. ``` → end